The leaks · 80 / 127 · 2 min

The invoice

The address in the document was changed. The payment followed the document. The coins followed the thief.

A worked case

A supplier's invoice arrives from a thread that looks old. One address has changed. The payment is sent. The supplier sends the real invoice the next week. The first payment is already in a wallet the supplier does not have. The check was a phone call on a number from before the email.

The mailbox

An invoice is a file. Whoever can edit the file, or the email it arrived in, can swap the address. The logo stays.

The check

Call a number you already had, not the number in the new email. Compare the address to one you have used before. A changed address is the whole attack. The chain will not know you were reading a letter.

The attachment was the attack

Business email compromise is a changed detail in a real-looking thread: a new account number, a new wallet address, a new urgent tone. The thief does not need to break a chain. They need the reader to trust the letter.

The check is dull. Use a number or an address you already had, from a source that is not this email. A logo in a PDF is not that source.

Read it yourself

• Business email compromise

These links are the record. They are not a recommendation, and they are not instructions. A news story or a court paper can still be wrong about a detail. The check does not change because a famous name is in the story.

Apply the check

Open a question. The line is about this topic. It is not a verdict that anything is safe.

Check yourself

Write it in your own words. The course's answer opens after that. Nothing is sent.